Skip to content

Commit

Permalink
[Dashboard] Fix Path Resolution on Windows (ray-project#41388)
Browse files Browse the repository at this point in the history
Use 'PurePosixPaths' when trying to canonicalize URL paths. This ensures that path resolution is independent of the underlying operating system and fixes the Ray Dashboard for Windows.
  • Loading branch information
ijrsvt authored and ujjawal-khare committed Nov 29, 2023
1 parent 24a2518 commit a5a8462
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions dashboard/http_server_head.py
Expand Up @@ -130,14 +130,19 @@ def get_address(self):
@aiohttp.web.middleware
async def path_clean_middleware(self, request, handler):
if request.path.startswith("/static") or request.path.startswith("/logs"):
parent = pathlib.Path(
parent = pathlib.PurePosixPath(
"/logs" if request.path.startswith("/logs") else "/static"
)

# If the destination is not relative to the expected directory,
# then the user is attempting path traversal, so deny the request.
request_path = pathlib.Path(request.path).resolve()
request_path = pathlib.PurePosixPath(
pathlib.posixpath.realpath(request.path)
)
if request_path != parent and parent not in request_path.parents:
logger.info(
f"Rejecting {request_path=} because it is not relative to {parent=}"
)
raise aiohttp.web.HTTPForbidden()
return await handler(request)

Expand Down

0 comments on commit a5a8462

Please sign in to comment.